WO2015173905A1

WO2015173905A1 - Encryption device, storage system, decryption device, encryption method, decryption method, encryption program, and decryption program

Info

Publication number: WO2015173905A1
Application number: PCT/JP2014/062822
Authority: WO
Inventors: 亨反町
Original assignee: 三菱電機株式会社
Priority date: 2014-05-14
Filing date: 2014-05-14
Publication date: 2015-11-19
Also published as: KR20170005850A; TWI565285B; TW201543862A; CN106463069A; DE112014006666T5; US20170126399A1; JP6203387B2; JPWO2015173905A1

Abstract

　An encryption device (100), wherein a division unit (130) determines the number of blocks that are encrypted using the same key as a processing unit, and divides plaintext data inputted from a second input unit (120) by the processing unit. An encryption unit (150) generates, from a common key inputted from a first input unit (110), a same number of mutually different processing keys (1-N) as the number of divisions (N) of plaintext data divided by the division unit (130), and generates encrypted data for each processing unit determined by the division unit (130) by encrypting each block of the plaintext data inputted from the second input unit (120) with a block cryptogram (F) by using a generated same processing key I (I = 1, 2, ..., N).

Description

Encryption device, storage system, decryption device, encryption method, decryption method, encryption program, and decryption program

The present invention relates to an encryption device, a storage system, a decryption device, an encryption method, a decryption method, an encryption program, and a decryption program. The present invention relates to an encryption and decryption technique capable of low delay processing in a common key cryptosystem, for example.

In recent years, various services using computers or communication devices have been provided. In many of these services, encryption technology is used to conceal or authenticate communication. Cryptographic schemes are broadly classified into common key cryptography that uses the same key for encryption and decryption, and public key cryptography that uses two types of keys with different secret keys and public keys. In common key cryptography, a method of sharing a key between senders and receivers becomes a problem. However, the common key encryption has an advantage that the processing amount required for encryption and decryption is small compared to the public key encryption. Therefore, common key cryptography is used in many fields and applications.

Demand for cryptography capable of low-latency processing with real-time performance is increasing in order to realize applications where response speed is important, such as read / write processing of secure storage devices. Several common key encryption techniques capable of performing low-delay processing have been proposed so far (see, for example, Non-Patent Document 1).

Non-Patent Document 1 proposes a low-delay block cipher algorithm PRINCE announced at ASIACRYPT 2012 as a design example of a common key cipher algorithm capable of low-delay processing. Non-Patent Document 1 evaluates the security of PRINCE compared to block ciphers known so far. However, the block cipher basically needs to be evaluated for differential cryptanalysis and linear cryptanalysis. Non-Patent Document 1 does not show provable security of PRINCE for differential cryptanalysis and linear cryptanalysis.

Several techniques have been proposed to protect the common key encryption algorithm implementation module from external monitoring attacks (see, for example, Patent Document 1).

In Patent Document 1, a technique for providing security against an external monitoring attack by calculating a plurality of consecutive intermediate keys from a secret key used for a common key encryption algorithm and deriving a message key from an internal secret state and a message identifier Has been proposed.

Special table 2013-513312 gazette

The design and development of a common key encryption algorithm is generally completed by evaluating the security of the algorithm itself for various cryptanalysis methods, determining the algorithm specifications. In order to use the algorithm developed in the actual system, the development of a cryptographic module taking into account the requirements such as operating conditions and processing performance has been carried out separately. Therefore, when the requirements of the system to which the algorithm is applied are strict, it takes a lot of time and effort to develop the cryptographic module. In some cases, the planned encryption algorithm cannot be applied, and another encryption algorithm with low security is adopted.

When developing cryptographic algorithms, there is a trade-off between security and processing performance. Conventionally, a method for efficiently realizing high security and low delay processing simultaneously has not been proposed. For example, in the low-delay block cipher algorithm PRINCE described above, as a required specification of the algorithm, the safety margin is set to be equal to or less than that of a general block cipher, and the internal arithmetic processing is simplified, thereby reducing the processing delay as much as possible. The method is adopted.

The object of the present invention is to achieve both high security and low delay processing in, for example, an encryption or decryption system.

According to one aspect of the present invention, an encryption apparatus that encrypts plaintext data using a block cipher is provided.
Determining the number of blocks to be encrypted using the same key as a processing unit, and dividing the plaintext data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the plaintext data in the division unit, and use the same processing key generated for each processing unit determined in the division unit, An encryption unit that generates encrypted data by encrypting each block of the plaintext data with the block cipher.

According to one aspect of the present invention, a decryption device that decrypts encrypted data using a block cipher,
Determining the number of blocks to be decrypted using the same key as a processing unit, and a dividing unit for dividing the encrypted data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the encrypted data in the dividing unit, and use the same processing key generated for each processing unit determined by the dividing unit, A decrypting unit that generates plaintext data by decrypting each block of the encrypted data with the block cipher.

In the present invention, the number of predetermined blocks is determined as a processing unit, and each block of plaintext data (or encrypted data) is encrypted (or decrypted) by block cipher using the same processing key for each processing unit. To do. Therefore, according to the present invention, it is possible to achieve both high security and low delay processing in the encryption (or decryption) method.

FIG. 2 is a block diagram illustrating a configuration of a cryptographic device according to the first embodiment. FIG. 3 is a block diagram illustrating a first configuration example of an encryption unit of the encryption device according to the first embodiment. 6 is a table showing an example of a data size that can be processed by the cryptographic apparatus according to the first embodiment. FIG. 3 is a block diagram showing a second configuration example of the encryption unit of the encryption device according to the first embodiment. The figure which shows the structural example of the block cipher which can be used in the example of FIG. FIG. 4 is a block diagram illustrating a third configuration example of the encryption unit of the encryption device according to the first embodiment. The figure which shows the structural example of the block cipher which can be used in the example of FIG. FIG. 4 is a block diagram showing a configuration of a decoding apparatus according to Embodiment 2. FIG. 4 is a block diagram illustrating a configuration of a storage system according to a third embodiment. The figure which shows an example of the hardware constitutions of the encryption apparatus which concerns on embodiment of this invention, a decryption apparatus, and a storage system.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of an encryption device 100 according to the present embodiment.

The encryption device 100 encrypts plaintext data (also referred to as “process data”) with the block cipher F.

1, the encryption device 100 includes a first input unit 110, a second input unit 120, a division unit 130, a calculation unit 140, an encryption unit 150, and an output unit 160.

The first input unit 110 has an interface function for receiving a common key (also referred to as “secret key”) used for the block cipher F from the outside. The first input unit 110 holds a common key received from the outside in a memory. The first input unit 110 passes the common key held in the memory to the encryption unit 150.

Thus, the first input unit 110 inputs the common key to the encryption unit 150.

The second input unit 120 has an interface function for receiving plaintext data encrypted by the block cipher F from the outside. The second input unit 120 holds plaintext data in the memory. The second input unit 120 passes the plain text data held in the memory to the dividing unit 130 and the encryption unit 150.

As described above, the second input unit 120 inputs the plain text data to the dividing unit 130 and the encryption unit 150.

The dividing unit 130 calculates the data size (that is, processing unit × block length) that can be processed with the same key, derived from the security evaluation result of the encryption algorithm (that is, the block cipher F) used in the encryption unit 150. Identify. The dividing unit 130 determines the number N of plaintext data divisions (that is, the number of groups when plaintext data is grouped in processing units) from the identified data size and the size of plaintext data input from the second input unit 120. Is calculated. Then, the dividing unit 130 notifies the calculation unit 140 and the encryption unit 150 of the division number N.

Thus, the dividing unit 130 determines the number of blocks to be encrypted using the same key as a processing unit, and divides the plaintext data input from the second input unit 120 in the processing unit. The processing unit is appropriately determined by the dividing unit 130 according to the configuration of the block cipher F (for example, the S-box size, the number of layers, and the block length). Alternatively, the processing unit is designated in advance according to the configuration of the block cipher F, and the designated unit is adopted by the dividing unit 130. Alternatively, the upper limit of the processing unit is specified in advance according to the configuration of the block cipher F, and the division unit 130 sets the upper limit or less. As will be described later, the processing unit is preferably determined according to the average differential probability or average linear probability of the block cipher F. In particular, by determining the average difference probability or the inverse of the average linear probability of the block cipher F as a processing unit, it is possible to optimize the encryption process while ensuring security.

The calculation unit 140 is included in each of the divided plaintext data block groups 1 to N from the division number N notified from the division unit 130 and the plaintext data address information input from the second input unit 120. Specify the data address of each block. The calculation unit 140 passes the identified data address and information on the block group to which the block corresponding to the data address belongs to the encryption unit 150.

Thus, the calculation unit 140 calculates the data address of each block of plaintext data.

The encryption unit 150 includes a processing key generation unit 151, a random data generation unit 152, and an encrypted data processing unit 153.

The processing key generation unit 151 receives the common key from the first input unit 110 and generates the same number of processing keys (also referred to as “pre-generated keys”) 1 to N as the division number N notified from the division unit 130. Then, the processing key generation unit 151 passes the processing keys 1 to N to the random data generation unit 152.

As described above, the processing key generation unit 151 generates different processing keys 1 to N having the same number as the division number N of the plaintext data in the division unit 130 from the common key input from the first input unit 110. For example, the processing key generation unit 151 uses the common key input from the first input unit 110 to encrypt the different data having the same number as the division number N of the plaintext data in the division unit 130 using the block cipher F. As a result, the processing keys 1 to N are generated.

The random data generation unit 152 and the encrypted data processing unit 153 have the same processing key I (I = 1, 2,...) Generated by the processing key generation unit 151 for each processing unit determined by the division unit 130. N) is used to encrypt each block of plaintext data input from the second input unit 120 with the block cipher F, thereby generating encrypted data.

Specifically, first, the random data generation unit 152 receives the processing keys 1 to N from the processing key generation unit 151 and the data address and block group information from the calculation unit 140. For the block group I, the random data generation unit 152 performs cryptographic processing using the data address as input data of the block cipher F and the processing key I as key data of the block cipher F. Then, the random data generation unit 152 passes random data that is output data of the block cipher F to the encrypted data processing unit 153.

As described above, the random data generation unit 152 uses the same processing key I generated by the processing key generation unit 151 for each processing unit determined by the division unit 130, and calculates each block calculated by the calculation unit 140. Are encrypted with the block cipher F.

Next, the encrypted data processing unit 153 receives the random data from the random data generation unit 152 and the plain text data from the second input unit 120, and executes a predetermined calculation. The encrypted data processing unit 153 passes the encrypted data that is the calculation result to the output unit 160.

As described above, the encrypted data processing unit 153 generates encrypted data from the data address of each block encrypted by the random data generation unit 152 and each block of plaintext data input from the second input unit 120. Generate. For example, the encrypted data processing unit 153 calculates an exclusive OR between the data address of each block encrypted by the random data generation unit 152 and each block of plaintext data input from the second input unit 120. The calculation result is output as encrypted data.

The output unit 160 receives the encrypted data from the encrypted data processing unit 153. The output unit 160 has an interface function for providing the encrypted data to the outside.

Thus, the output unit 160 outputs the encrypted data generated by the encryption unit 150.

In this embodiment, the plaintext data is divided, and the processing key used for the block cipher F is changed for each division unit (that is, processing unit), thereby making the decryption difficult. As the block cipher F, an encryption algorithm capable of low delay processing can be applied. Therefore, according to the present embodiment, it is possible to achieve both high safety and low delay processing.

For the block cipher F, it is desirable to apply a cryptographic algorithm having provable security against differential cryptanalysis and linear cryptanalysis, such as MISTY (registered trademark) and KASUMI. If the block cipher F has provable security against differential cryptanalysis and linear cryptanalysis, the number of blocks equal to the inverse of the average differential probability (or average linear probability) of the block cipher F is set as a processing unit. Thus, it is possible to ensure safety. For example, if the average difference probability of the block cipher F is 2 ⁻²⁴ , 2 ²⁴ blocks are the processing unit. Note that a smaller number of blocks than the inverse of the average difference probability (or average linear probability) of the block cipher F may be set as a processing unit. That is, the reciprocal of the average difference probability (or average linear probability) of the block cipher F may be used as the upper limit of the processing unit. For example, if the average differential probability 2 ^-24 block cipher F, 2 ²³ or fewer number of blocks may be processed units.

As described above, it is desirable to apply a cryptographic algorithm having provable security against differential cryptanalysis and linear cryptanalysis to the block cipher F, but other cryptographic algorithms such as AES (Advanced Encryption Standard) are used. It can also be applied. In that case, the number of blocks for which a certain degree of safety can be expected may be set as a processing unit. For example, a power of 2 (that is, 2 ^{L / 2} ) blocks having an index that is half of the number of bits L (that is, the block length) of one block can be set as the processing unit or the upper limit of the processing unit. When using AES, because the block length is 128 bits, 2 ⁶⁴ or fewer number block is a processing unit.

FIG. 2 is a block diagram illustrating a first configuration example of the encryption unit 150. FIG. 3 is a table showing examples of data sizes that can be processed by the encryption apparatus 100.

The processing key generation unit 151 needs to use an algorithm that cannot infer the original common key from the processing key when generating the processing key from the common key. Although there are various options as such an algorithm, for example, the same encryption algorithm (that is, block cipher F) as the random data generation unit 152 can be used.

In the example of FIG. 2, the processing key generation unit 151 uses the common key K as key data, and gives different input data of 1, 2,. Processing keys K ₁ , K ₂ ,..., K _x−1 are generated. In this example, it is assumed that an encryption algorithm having provable security for differential cryptanalysis and linear cryptanalysis is applied to the block cipher F. By using such an encryption algorithm for the generation of a processing key, it is possible to ensure the safety of the processing key with respect to the differential cryptanalysis method and the linear cryptanalysis method.

As in the example of FIG. 3, the data size that can be processed with one processing key varies depending on the configuration of the block cipher F. Assuming that the key length of the block cipher F is 128 bits, in the example of FIG. 2, (c) the configuration of the block cipher F having a block length of 128 bits can be used. For example, if (a) the S-box size is a combination of 8 bits and 8 bits, (b) the number of layers is 4 and (c) the block length is 128 bits, the configuration of the block cipher F is used (d ) average differential probability and the average linear probability to become a 2 ^-96, the upper limit of the processing units or processing units is 2 ^96. Therefore, (e) the data size that can be processed with the same processing key is ²¹⁰⁰ bytes (= 2 ⁹⁶ × 128 bits). Since the processing key is generated by the block cipher F, the number of processing keys that can be generated from the same common key is also ²⁹⁶ . Therefore, (f) the data size that can be processed as a whole is 2 ¹⁹⁶ bytes (= 2 ⁹⁶ × 2 ¹⁰⁰ bytes), and (g) the memory size necessary for storing a 128-bit processing key is 2 ¹⁰⁰ bytes ( = ²⁹⁶ × 128 bits). In the example of FIG. 2, another configuration can be used as the configuration of the block cipher F. The key length of the block cipher F is not limited to 128 bits.

As described above, when the processing key generation unit 151 generates the processing keys K ₁ , K ₂ ,..., K _x−1 using the block cipher F, it is possible to set a data size that can be processed as a whole. . If the size of plaintext data input from the second input unit 120 exceeds the data size that can be processed as a whole, an additional common key K ′ may be input from the first input unit 110. By using the additional common key K ′ and encrypting the portion of the plaintext data that exceeds the data size that can be processed, the security of the portion is also ensured.

In the example of FIG. 2, when the data size that can be processed by one processing key was n block, random data generator 152, using the processing key K ₁ generated by the processing key generation unit 151 as a key data , data address _ad 1 block cipher _F, ad 2, · · ·, by giving ad _n, data address _ad _1, ad 2, · · ·, to generate random data corresponding to ad _n. The random data generation unit 152 uses the processing key K ₂ generated by the processing key generation unit 151 as key data, and gives the block cipher F data addresses ad _{n + 1} , ad _{n + 2} ,..., Ad _2n . Random data corresponding to data addresses ad _{n + 1} , ad _{n + 2} ,..., Ad _2n are generated. Similarly, for the subsequent data addresses, the random data generation unit 152 generates random data using one processing key for every n blocks.

In the example of FIG. 2, the encrypted data processing unit 153 calculates the exclusive OR of the random data generated by the random data generation unit 152 and the corresponding plaintext data block. The encrypted data processing unit 153 outputs the operation results C ₁ , C ₂ ,..., C _{(x−1) n + 1} as encrypted data.

When only the data of some addresses is changed after encrypting the data of all addresses, the random data generation unit 152 specifies the address where the data has been changed from the memory map 170 of the encrypted data. . The encrypted data processing unit 153 may calculate the exclusive OR of the random data and the corresponding block of plaintext data (that is, the changed data) only for the address specified by the random data generation unit 152. . Therefore, it is possible to realize low delay processing.

FIG. 4 is a block diagram showing a second configuration example of the encryption unit 150. FIG. 5 is a diagram illustrating a configuration example of the block cipher F that can be used in the example of FIG.

In the example of FIG. 2, it is assumed that the key length and the block length of the block cipher F are the same, but the key length and the block length of the block cipher F may be different. For example, the key length may be twice the block length.

In the example of FIG. 4, the processing key generation unit 151 divides the common key K into partial keys Ka and Kb. The processing key generation unit 151 uses the partial keys Ka and Kb as key data, and gives different input data of 1, 2,. ₁ , K ₂ ,..., K _x−1 are generated. For example, the processing key generation unit 151 uses the partial keys Ka and Kb as key data, and inputs 1 to the block cipher F to obtain keys K _1a and K _1b . Then, the processing key generation unit 151 generates the processing key K ₁ by connecting the keys K _1a and K _1b . Also in this example, it is assumed that a cryptographic algorithm having provable security against differential cryptanalysis and linear cryptanalysis is applied to the block cipher F.

Assuming that the key length of the block cipher F is 128 bits, the example of FIG. 4 can use the configuration of the block cipher F having a block length of 64 bits as in the example of FIG. In the example of FIG. 5, an S-box in units of 8 bits is used. The average difference probability and average linear probability of the S-box alone are 2 ⁻⁶ , respectively. Since the configuration of the internal function Fi has provable security with respect to the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the internal function Fi alone are ^2-12 , respectively. Similarly, since the configuration of the internal function Fo has provable security against the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the internal function Fo alone are ^2-24 , respectively. Since the configuration of the block cipher F also has provable security against the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the entire block cipher F are ^2-48 , respectively. Referring to FIG. 3, in the example of FIG. 5, a block cipher F in which (a) the S-box size is a combination of 8 bits and 8 bits, (b) the number of layers is 3, and (c) the block length is 64 bits. will be the configuration is being used, (d) an average differential probability and average linear probability to become a 2 ^-48, the upper limit of the processing units or processing units is 2 ^48. Therefore, (e) the data size that can be processed with the same processing key is ^2.51 bytes (= 2 ⁴⁸ × 64 bits). Since the processing key is generated by block cipher F, also becomes 2 ⁴⁸ number of possible processing key generated from the same common key. Therefore, (f) the data size that can be processed as a whole is ²⁹⁹ bytes (= 2 ⁴⁸ × 2 ⁵¹ bytes), and (g) the memory size required for storing a 128-bit processing key is ²⁵² bytes ( = 2 ⁴⁸ × 128 bits). In the example of FIG. 4, a configuration different from the example of FIG. 5 can be used as the configuration of the block cipher F. The key length of the block cipher F is not limited to 128 bits.

FIG. 6 is a block diagram illustrating a third configuration example of the encryption unit 150. FIG. 7 is a diagram illustrating a configuration example of the block cipher F that can be used in the example of FIG.

In the example of FIG. 4, the key length of the block cipher F is twice the block length, but the key length may be three times the block length, for example.

In the example of FIG. 6, the processing key generator 151 divides the common key K into partial keys Ka, Kb, and Kc. The processing key generation unit 151 uses the partial keys Ka, Kb, and Kc as key data, and gives different input data of 1, 2,. Keys K ₁ , K ₂ ,..., K _x−1 are generated. For example, the processing key generation unit 151 uses the partial keys Ka, Kb, and Kc as key data, and inputs 1 to the block cipher F to obtain keys K _1a , K _1b , and K _1c . Then, the processing key generating unit 151, by connecting key _K _1a, K _1b, a _{K 1c,} to generate processed key _{K 1.} Also in this example, it is assumed that a cryptographic algorithm having provable security against differential cryptanalysis and linear cryptanalysis is applied to the block cipher F.

Assuming that the key length of the block cipher F is 192 bits, the example of FIG. 6 can use the configuration of the block cipher F having a block length of 64 bits as in the example of FIG. In the example of FIG. 7, a 7-bit S-box and a 9-bit S-box are used. The average differential probability and average linear probability of a 7-bit S-box unit are 2 ⁻⁶ , respectively. The average differential probability and average linear probability of a 9-bit S-box unit are 2 ⁻⁸ , respectively. Since the configuration of the internal function Fi has provable security with respect to the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the internal function Fi alone are 2 ⁻¹⁴ , respectively. Similarly, since the configuration of the internal function Fo has provable security with respect to the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the internal function Fo alone are ²⁻²⁸ , respectively. Since the configuration of the block cipher F also has provable security against the differential cryptanalysis and the linear cryptanalysis, the average differential probability and the average linear probability of the entire block cipher F are ^2-56 , respectively. Referring to FIG. 3, in the example of FIG. 7, (a) a block cipher F in which the S-box size is a combination of 7 bits and 9 bits, (b) the number of layers is 3, and (c) the block length is 64 bits. will be the configuration is being used, (d) an average differential probability and average linear probability to become a 2 ^-56, the upper limit of the processing units or processing units is 2 ^56. Therefore, (e) the data size that can be processed with the same processing key is ²⁵⁹ bytes (= 2 ⁵⁶ × 64 bits). Since the processing key is generated by the block cipher F, the number of processing keys that can be generated from the same common key is also ²⁵⁶ . Therefore, the data size that can be processed as a whole (f) is 2 ¹¹⁵ bytes (= 2 ⁵⁶ × 2 ⁵⁹ bytes). Although not shown in FIG. 3, the total memory size required to store a 192-bit processing key is approximately ²⁶¹ bytes (more precisely, 1.5 × 2 ⁶⁰ bytes≈2 ⁵⁶ × 192 bits). Become. In the example of FIG. 6, a configuration different from the example of FIG. 7 can be used as the configuration of the block cipher F. The key length of the block cipher F is not limited to 192 bits.

変更 Changing the internal configuration of the block cipher F used will affect the security of the block cipher F alone. However, as in the example of FIGS. 4 and 6, the security of the entire system can be ensured by changing the processing key in units of safe data size.

In the example of FIG. 2, the encryption algorithm used in the random data generation unit 152 is configured to ensure provable security for differential cryptanalysis and linear cryptanalysis. As shown in the examples of Figs. 4 and 6, even if the input / output interface is the same, it is possible to cope with an algorithm capable of low-latency processing by changing the internal algorithm configuration according to the required processing performance of the system. It becomes. In the examples of FIGS. 4 and 6, the security of the block cipher F with respect to the differential cryptanalysis and the linear cryptanalysis is different, but the security of the entire system is ensured by changing the data size that can be processed with one processing key. Is possible.

In the examples of FIGS. 4 and 6, the number of stages of the highest layer of the block cipher F is different between 3 stages and 4 stages, respectively. Also, the S-box used in the internal function Fi is different for one type of 8 bits and two types of 7 bits and 9 bits. Due to this difference, the example of FIG. 4 can be processed with lower delay. Due to the difference in the configuration of the block cipher F, by taking a trade-off between the processing performance required for the entire system and the memory size required for storing the processing key, a system capable of low-latency processing is realized, It is possible to realize a system that does not deteriorate the overall safety.

As described above, the cryptographic apparatus 100 according to the present embodiment determines the number of divisions of processing data that can ensure security with a single key from the numerically evaluated security of a single cryptographic algorithm. The encryption device 100 generates the same number of processing keys as the determined number of divisions from the secret key used for the encryption method capable of low delay processing. The encryption device 100 calculates the data address of the processing data. The encryption device 100 generates random data corresponding to the processing data using a corresponding processing key, using an encryption algorithm having provable security. The encryption device 100 generates encrypted data from the processing data and random data. Then, the encryption device 100 outputs the encrypted data.

According to the present embodiment, by simplifying the configuration of the encryption algorithm, it is possible to ensure the safety of the entire encryption method while realizing an encryption method capable of low delay processing. That is, it is possible to realize low delay processing and secure safety at the same time.

Embodiment 2. FIG.
FIG. 8 is a block diagram showing a configuration of decoding apparatus 200 according to the present embodiment.

The decryption device 200 decrypts the encrypted data with the block cipher F. The block cipher F is the same as that of the first embodiment.

8, the decoding device 200 includes a first input unit 210, a second input unit 220, a dividing unit 230, a calculation unit 240, a decoding unit 250, and an output unit 260.

The first input unit 210, the second input unit 220, the dividing unit 230, the calculation unit 240, the decryption unit 250, and the output unit 260 are respectively the first input unit 110 and the second input unit of the encryption device 100 according to the first embodiment. 120, a division unit 130, a calculation unit 140, an encryption unit 150, and an output unit 160.

The first input unit 210 inputs the common key to the decryption unit 250.

The second input unit 220 inputs the encrypted data to the dividing unit 230 and the decrypting unit 250.

The dividing unit 230 determines the number of blocks to be encrypted using the same key as a processing unit, and divides the encrypted data input from the second input unit 220 into the processing unit. The processing unit is the same as that in the first embodiment.

The calculation unit 240 calculates the data address of each block of the encrypted data.

The decryption unit 250 includes a processing key generation unit 251, a random data generation unit 252, and a decryption data processing unit 253.

The processing key generation unit 251, the random data generation unit 252, and the decryption data processing unit 253 correspond to the processing key generation unit 151, the random data generation unit 152, and the encrypted data processing unit 153 of the encryption device 100 according to Embodiment 1. It has a function.

The processing key generation unit 251 generates different processing keys 1 to N having the same number as the division number N of the encrypted data in the division unit 230 from the common key input from the first input unit 210. For example, the processing key generation unit 251 uses the common key input from the first input unit 210 to encrypt the same number of different data with the block cipher F as the division number N of the encrypted data in the division unit 230. As a result, the processing keys 1 to N are generated.

The random data generation unit 252 and the decryption data processing unit 253 generate the same processing key I (I = 1, 2,..., N) generated by the processing key generation unit 251 for each processing unit determined by the division unit 230. ) Is used to decrypt each block of the encrypted data input from the second input unit 220 using the block cipher F, thereby generating plaintext data (ie, decrypted data).

Specifically, the random data generating unit 252 uses the same processing key I generated by the processing key generating unit 251 for each processing unit determined by the dividing unit 230, and calculates each of the units calculated by the calculating unit 240. The block data address is encrypted by the block cipher F. The decrypted data processing unit 253 generates decrypted data from the data address of each block encrypted by the random data generating unit 252 and each block of the encrypted data input from the second input unit 220. For example, the decryption data processing unit 253 calculates an exclusive OR of the data address of each block encrypted by the random data generation unit 252 and each block of the encrypted data input from the second input unit 220. The calculation result is output as decoded data.

The output unit 260 outputs the decoded data generated by the decoding unit 250.

In the present embodiment, a decryption process corresponding to the encryption process in the first embodiment is performed. Therefore, according to the present embodiment, as in the first embodiment, both high security and low delay processing can be achieved.

Embodiment 3 FIG.
FIG. 9 is a block diagram showing a configuration of the storage system 300 according to the present embodiment.

9, the storage system 300 includes the same encryption device 100 as in the first embodiment and the same decryption device 200 as in the second embodiment. The storage system 300 includes a tamper resistant device 310, a control device 320, and a storage medium 330.

The tamper resistant device 310 stores a common key. The common key is the same as in the first and second embodiments.

When the control device 320 receives a request to write data to the storage medium 330 from the outside, the control device 320 sends a command to write the data to the storage medium 330 to the encryption device 100 and sends a common key from the tamper resistant device 310 to the encryption device 100. In addition, when the control device 320 receives a request to read data from a specific address of the storage medium 330 from the outside, the control device 320 sends a command to read the data from the address to the decryption device 200, and also decrypts the common key from the tamper resistant device 310. Send to 200. When receiving data from the decoding device 200, the control device 320 provides the received data to the outside.

Storage medium 330 (for example, hard disk) stores encrypted data.

It is desirable that the encryption device 100 and the decryption device 200 are integrally mounted (for example, on one integrated circuit chip).

When receiving the command for writing the common key and data (ie, plaintext data) to the storage medium 330, the encryption device 100 generates encrypted data by the encryption unit 150 and writes the encrypted data to the storage medium 330.

Upon receiving the common key and a command to read data from a specific address of the storage medium 330, the decryption device 200 reads the encrypted data from the address, generates plaintext data at the decryption unit 250, and uses the data to the control device 320. Output to.

In the storage medium 330, all address data is encrypted. However, the random data generation unit 252 of the decoding unit 250 can generate random data from an address specified by a command from the control device 320. Therefore, the decryption data processing unit 253 of the decryption unit 250 uses only the random data generated by the random data generation unit 252 and the encrypted data stored in the storage medium 330 for the address specified by the command from the control device 320. The plaintext data can be restored by calculating the exclusive OR with this block. Therefore, in the present embodiment, data can be safely stored in the storage medium 330 and necessary data can be read from the storage medium 330 at high speed.

FIG. 10 is a diagram illustrating an example of a hardware configuration of the encryption device 100, the decryption device 200, and the storage system 300 according to the embodiment of the present invention.

10, the encryption device 100, the decryption device 200, and the storage system 300 are each a computer and include hardware such as an output device 910, an input device 920, a storage device 930, and a processing device 940. The hardware is used by each unit of the encryption device 100, the decryption device 200, and the storage system 300 (what will be described as “unit” in the description of the embodiment of the present invention).

The output device 910 is, for example, a display device such as an LCD (Liquid / Crystal / Display), a printer, or a communication module (communication circuit or the like). The output device 910 is used for outputting (transmitting) data, information, and signals by what is described as “unit” in the description of the embodiment of the present invention.

The input device 920 is, for example, a keyboard, a mouse, a touch panel, a communication module (communication circuit or the like). The input device 920 is used for inputting (receiving) data, information, and signals by what is described as a “unit” in the description of the embodiment of the present invention.

The storage device 930 is, for example, a ROM (Read / Only / Memory), a RAM (Random / Access / Memory), a HDD (Hard / Disk / Drive), or an SSD (Solid / State / Drive). The storage device 930 stores a program 931 and a file 932. The program 931 includes a program for executing processing (function) described as “unit” in the description of the embodiment of the present invention. The file 932 includes data, information, signals (values), and the like that are calculated, processed, read, written, used, input, output, etc. by what is described as “parts” in the description of the embodiment of the present invention. It is.

The processing device 940 is, for example, a CPU (Central Processing Unit). The processing device 940 is connected to other hardware devices via a bus or the like, and controls those hardware devices. The processing device 940 reads the program 931 from the storage device 930 and executes the program 931. The processing device 940 is used for performing calculation, processing, reading, writing, use, input, output, and the like by what is described as “unit” in the description of the embodiment of the present invention.

In the description of the embodiment of the present invention, what is described as “unit” may be replaced by “circuit”, “device”, and “apparatus”. Further, what is described as “part” in the description of the embodiment of the present invention may be “part” replaced with “process”, “procedure”, and “process”. That is, what is described as a “unit” in the description of the embodiment of the present invention is realized by software alone, hardware alone, or a combination of software and hardware. The software is stored in the storage device 930 as the program 931. The program 931 causes the computer to function as what is described as “unit” in the description of the embodiment of the present invention. Alternatively, the program 931 causes the computer to execute the processing described as “unit” in the description of the embodiment of the present invention.

As mentioned above, although embodiment of this invention was described, you may implement combining some of these embodiment. Alternatively, any one or some of these embodiments may be partially implemented. For example, only one of those described as “parts” in the description of these embodiments may be employed, or some arbitrary combinations may be employed. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

100 cryptographic device, 110 first input unit, 120 second input unit, 130 dividing unit, 140 calculating unit, 150 cryptographic unit, 151 processing key generating unit, 152 random data generating unit, 153 encrypted data processing unit, 160 output unit , 170 memory map, 200 decryption device, 210 first input unit, 220 second input unit, 230 division unit, 240 calculation unit, 250 decryption unit, 251 processing key generation unit, 252 random data generation unit, 253 decryption data processing unit , 260 output unit, 300 storage system, 310 tamper resistant device, 320 control device, 330 storage medium, 910 output device, 920 input device, 930 storage device, 931 program, 932 file, 940 processing device.

Claims

In an encryption device that encrypts plaintext data with a block cipher,
Determining the number of blocks to be encrypted using the same key as a processing unit, and dividing the plaintext data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the plaintext data in the division unit, and use the same processing key generated for each processing unit determined in the division unit, An encryption apparatus comprising: an encryption unit that generates encrypted data by encrypting each block of plaintext data with the block cipher.
A calculation unit for calculating a data address of each block of the plaintext data;
The encryption unit encrypts the data address of each block calculated by the calculation unit using the block encryption by using the same processing key generated for each processing unit determined by the division unit. 2. The encryption apparatus according to claim 1, wherein the encrypted data is generated from a data address of each block and each block of the plaintext data.
The encryption unit according to claim 2, wherein the encryption unit calculates an exclusive OR of the encrypted data address of each block and each block of the plaintext data, and outputs the calculation result as the encrypted data. apparatus.
4. The encryption apparatus according to claim 1, wherein the dividing unit determines the processing unit according to a configuration of the block cipher.
5. The encryption apparatus according to claim 1, wherein the dividing unit determines the processing unit according to an average difference probability or an average linear probability of the block cipher.
6. The encryption apparatus according to claim 1, wherein the dividing unit determines an average difference probability or an inverse number of an average linear probability of the block cipher as the processing unit.
The encryption unit uses the common key to generate the processing key by encrypting the same number of different data as the number of divisions of the plaintext data in the division unit with the block cipher. 7. The encryption device according to claim 1, wherein
An encryption device according to any one of claims 1 to 7;
A storage medium for storing data,
When the encryption device receives the common key and a command to write the plaintext data to the storage medium, the encryption unit generates the encrypted data and writes the encrypted data to the storage medium. Storage system.
In a decryption device that decrypts encrypted data using a block cipher,
Determining the number of blocks to be decrypted using the same key as a processing unit, and a dividing unit for dividing the encrypted data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the encrypted data in the dividing unit, and use the same processing key generated for each processing unit determined by the dividing unit, A decrypting apparatus comprising: a decrypting unit configured to decrypt plaintext data by decrypting each block of the encrypted data with the block cipher.
A calculation unit for calculating a data address of each block of the encrypted data;
The decryption unit encrypts the data address of each block calculated by the calculation unit using the block cipher by using the same processing key generated for each processing unit determined by the division unit The decryption apparatus according to claim 9, wherein the plaintext data is generated from a data address of each block and each block of the encrypted data.
The decryption unit according to claim 10, wherein the decryption unit calculates an exclusive OR of the data address of each encrypted block and each block of the encrypted data, and outputs the calculation result as the plaintext data. apparatus.
12. The decryption apparatus according to claim 9, wherein the division unit determines the processing unit according to a configuration of the block cipher.
13. The decryption apparatus according to claim 9, wherein the division unit determines the processing unit according to an average difference probability or an average linear probability of the block cipher.
14. The decryption device according to claim 9, wherein the dividing unit determines an average difference probability or an inverse number of an average linear probability of the block cipher as the processing unit.
The decryption unit uses the common key to generate the processing key by encrypting the same number of different data with the block cipher as the number of divisions of the encrypted data in the division unit. The decoding device according to claim 9, wherein:
A decoding device according to any one of claims 9 to 15,
A storage medium for storing the encrypted data,
Upon receiving the common key and an instruction to read data from the storage medium, the decryption device reads the encrypted data from the storage medium, generates the plaintext data at the decryption unit, and outputs the plaintext data A storage system characterized by that.
In an encryption method for encrypting plaintext data with a block cipher,
The computer determines the number of blocks to be encrypted using the same key as a processing unit, divides the plaintext data by the processing unit,
The computer generates, from a common key, the same number of different processing keys as the number of divisions of the plaintext data, and uses each generated processing key for each block of the plaintext data for each processing unit. An encryption method characterized by generating encrypted data by encrypting with a block cipher.
In a decryption method for decrypting encrypted data by block cipher,
The computer determines the number of blocks to be decrypted using the same key as a processing unit, divides the encrypted data by the processing unit,
The computer generates, from a common key, the same number of different processing keys as the number of divisions of the encrypted data, and uses each generated processing key for each block of the encrypted data for each processing unit. A plaintext data is generated by decrypting the data with the block cipher.
In an encryption program that encrypts plaintext data using a block cipher,
On the computer,
A division process for determining the number of blocks to be encrypted using the same key as a processing unit, and dividing the plaintext data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the plaintext data in the division processing, and use the same processing key generated for each processing unit determined in the division processing, An encryption program for executing encryption processing for generating encrypted data by encrypting each block of plaintext data with the block cipher.
In a decryption program for decrypting encrypted data by block cipher,
On the computer,
A division process for determining the number of blocks to be decrypted using the same key as a processing unit, and dividing the encrypted data by the processing unit;
From the common key, generate the same number of different processing keys as the number of divisions of the encrypted data in the division processing, and use the same processing key generated for each processing unit determined in the division processing, A decryption program that performs decryption processing for generating plaintext data by decrypting each block of the encrypted data with the block cipher.